lorentz/wulf-pulse
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs(phase-16): update tracking after wave 1

Browse source
This commit is contained in:
lorentz 2026-07-15 10:33:49 -04:00
parent f3ace33f86
commit 36ef9e7ce3
2 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.planning/ROADMAP.md
View file

@ -391,8 +391,8 @@ summarizes classification, blast radius, and recommended/approved remediation st
4. Parsed output includes a sanitized/truncated body preview stored alongside the raw evidence, distinct from the full raw body
5. `npx vitest run` for the new parser test file passes using synthetic fixtures only (no real customer email)
**Plans**: 3 plans
- [ ] 16-01-PLAN.md — Deps (mailparser + linkify-it) + pure EML parser: 3-tier selection, RFC822/MIME normalization, structured SPF/DKIM/DMARC verdicts, sanitized preview, no-network + size-guard tests (EVID-02, EVID-03, EVID-04)
- [ ] 16-02-PLAN.md — Supporting infra: AutotaskClient.getAttachmentContent (items[0]), b2 EML_OBJECT_KEY_REGEX + parameterized key validation, migration 099 indicators.metadata JSONB (EVID-03, EVID-04; D-05, D-07)
- [x] 16-01-PLAN.md — Deps (mailparser + linkify-it) + pure EML parser: 3-tier selection, RFC822/MIME normalization, structured SPF/DKIM/DMARC verdicts, sanitized preview, no-network + size-guard tests (EVID-02, EVID-03, EVID-04)
- [x] 16-02-PLAN.md — Supporting infra: AutotaskClient.getAttachmentContent (items[0]), b2 EML_OBJECT_KEY_REGEX + parameterized key validation, migration 099 indicators.metadata JSONB (EVID-03, EVID-04; D-05, D-07)
- [ ] 16-03-PLAN.md — phishing-eml-service orchestration: list→select→fetch→B2 (gated)→parse→persist messages/indicators, end-to-end no-network + graceful-degrade tests (EVID-03, EVID-04; D-05, D-06, D-07)
**UI hint**: no
@ -481,7 +481,7 @@ Phases execute in numeric order. v1.0 (Phases 1-9.1) shipped 2026-07-10. v2.0 (P
| 13. Scheduler & Admin Toggle | v2.0 | 3/3 | Complete | 2026-07-11 |
| 14. /pax8 UI Surface | v2.0 | 6/6 | Complete | 2026-07-12 |
| 15. Data Model, Detection & Ticket Evidence | v3.0 | 3/3 | Complete | 2026-07-15 |
| 16. EML/MIME Evidence Parser | v3.0 | 0/3 | Planned | - |
| 16. EML/MIME Evidence Parser | v3.0 | 2/3 | In Progress| |
| 17. Mimecast Blast Radius Lookup | v3.0 | 0/TBD | Not started | - |
| 18. Campaign Grouping & Phishing Analysis API | v3.0 | 0/TBD | Not started | - |
| 19. Classification Engine | v3.0 | 0/TBD | Not started | - |

14
.planning/STATE.md
View file

@ -4,8 +4,8 @@ milestone: v3.0
milestone_name: Phishing Triage Automation
status: executing
stopped_at: Phase 16 context gathered
last_updated: "2026-07-15T14:17:04.813Z"
last_activity: 2026-07-15 -- Phase 16 planning complete
last_updated: "2026-07-15T14:18:57.463Z"
last_activity: 2026-07-15 -- Phase 16 execution started
progress:
total_phases: 7
completed_phases: 1
@ -21,14 +21,14 @@ progress:
See: .planning/PROJECT.md (updated 2026-07-14)
**Core value:** A manager/security operator can see every phishing/spam report ticket automatically triaged, deduplicated into campaigns, and classified — with any destructive remediation gated behind explicit human approval.
**Current focus:** Phase 16 — eml/mime evidence parser
**Current focus:** Phase 16 — eml-mime-evidence-parser
## Current Position
Phase: 16
Plan: Not started
Status: Ready to execute
Last activity: 2026-07-15 -- Phase 16 planning complete
Phase: 16 (eml-mime-evidence-parser) — EXECUTING
Plan: 1 of 3
Status: Executing Phase 16
Last activity: 2026-07-15 -- Phase 16 execution started
Progress: [░░░░░░░░░░] 0%